Checkpoints & agents

Website, Port, Ping, and UDP monitors run from a checkpoint — the place that actually performs the check. There are two kinds.

Shared probe locations

CuliPulse runs shared checkpoints in Singapore, Frankfurt, and Montreal. Pick one when you create a monitor — or several on a paid plan — with no setup, no install. Watching from more than one also protects you from false alarms (see only alerting when more than one checkpoint fails).

Use shared locations for anything reachable from the public internet.

Shared locations can’t reach private addresses

Checks from CuliPulse’s shared locations never connect to private, loopback, or link-local addresses (such as 10.x.x.x, 192.168.x.x, or 127.0.0.1). That includes a site that redirects to one, or a domain whose address later changes to one. The check fails with “Address is on a private network — shared checkpoints can’t reach it”. To monitor an internal host, run your own agent. An HTTP monitor on a private IP address can use only your own agents (see below).

The same goes for a private name such as db.internal, redis or nas.local: shared locations can only look up public domains, so a website, ping, port or UDP monitor on one reads “Domain not found” or “no answer before the timeout” even though the server is fine. With a shared location ticked, that monitor shows as Down for good, and with the default setting one shared location is enough to raise the alert, so you would get a false alarm.

For a private target, pick only your own agents. To cross-check it, add a second agent of your own rather than a shared location. The monitor form warns you when a website, ping, port or UDP target looks private (a private name or a private address such as 192.168.1.10) and a shared location is selected. The warning is a heads-up, not a block: names that look private can sometimes be public. Monitors created through the API or Terraform get no such warning.

Your own agent

An agent is a small program you run on your own infrastructure so CuliPulse can check things that shared locations can’t reach — an internal API, a database behind a firewall, a service on your office LAN or inside your VPC.

It only needs outbound HTTPS to CuliPulse — no inbound port to open, no VPN, no firewall changes.
It appears in your Agents list and is selectable as a checkpoint on any monitor, right alongside the shared locations.
An agent can run HTTP/TLS, TCP, Ping (ICMP), and UDP checks. You don’t choose which when you enroll it: the agent reports what it can run when it first connects, and the Agents page shows that list. Certificate-expiry checks run on agents only.

See Installing an agent to set one up, and to update or remove one later.

Private IP addresses

An HTTP monitor can use a private IP address as its address, such as http://192.168.1.10/ or http://10.0.0.5:8080/, only when every location on the monitor is one of your own agents. If a shared location is also selected, or none is, CuliPulse refuses to save it and says so: shared locations can never reach private addresses. Remove the shared locations, or use your own agent only.

Saved passwords and tokens

Your own agents never receive saved sign-in details (bearer or basic), secret headers, secret request bodies or secret TCP/UDP payloads. So a check from your own agent runs without them, and an endpoint that needs them answers with an error (or, if it doesn’t ask for them, passes without testing them). Shared locations do send them.

If a monitor needs only one location to agree, a failing check from your own agent marks it down by itself. If it needs more, the same happens whenever the shared locations stop reporting.

CuliPulse tells you when you save such a monitor: the console shows a notice before you save, the API answers with a warnings entry, and Terraform shows a warning. The notice repeats on every save, and on every Terraform apply, while the combination stands. To check an endpoint that needs saved credentials, use a shared location, if the endpoint is reachable from the public internet.

How many, how much

Private agents are unlimited on every plan — there’s no cap on how many you run, and no per-agent throughput limit by default. Run one per network you need to reach.

Managing agents

From the Agents list you can see an agent’s version and whether it’s up to date, watch its check rate, and revoke it. You can also regenerate its token — the old token stops working immediately, so use this if a token may have leaked (then restart the agent with the new one).

When an agent goes offline

If an agent stops checking in for about 10 minutes, CuliPulse marks it offline and sends an agent.offline alert (and agent.online when it returns) to your notification destinations, noting how many monitors it affects.

Monitors that relied only on that agent become unknown rather than falsely down, and their alert names the agent that stopped checking in.

The console shows it everywhere you look, so a stopped agent never reads as healthy:

On the Agents page, an agent that missed a check-in shows as not responding (amber) and one past 10 minutes shows as offline (red). Both count in the attention banner and the Reachable summary, and an offline agent’s location no longer counts towards Coverage.
On the agent’s own page, the status under “Connect this agent” says it is offline (or not responding) instead of “Agent connected”.
On a monitor that only that agent checked, the monitor page shows Unknown, says which agent stopped sending results and since when, and marks the last reading as possibly out of date.

The same happens when you delete or revoke the only agent checking a monitor. Either way, an incident that was open on such a monitor is closed so it stops counting downtime; if the target is still failing once an agent checks it again, a new incident opens with a fresh alert (see Incidents).

When you delete or revoke an agent, monitors that also check from other locations keep running from those. If a monitor was set to confirm from more locations than remain, that number is lowered to the locations that are left, so the monitor can still go down. The Revoke screen shows how many monitors this affects before you confirm.